Remote Code Execution in Asterisk Due to Q.931 Parser Flaw
CVE-2026-57186
7.5HIGH
What is CVE-2026-57186?
A vulnerability exists in Asterisk's chan_ooh323 Q.931 party-number parser, which was not patched to include the necessary fix from CVE-2022-37325. This oversight allows attackers to send malformed Q.931 elements within OOH323 requests, potentially leading to a crash of the Asterisk service. This issue affects Asterisk versions starting from 21.0.0-pre1 up to specific releases in the 21.x, 22.x, and 23.x series, and requires the explicit installation of the vulnerable chan_ooh323 addon channel driver with a publicly reachable port.
Affected Version(s)
asterisk >= 21.0.0-pre1, < 21.12.3 < 21.0.0-pre1, 21.12.3
asterisk >= 22.0.0-pre1, < 22.10.1 < 22.0.0-pre1, 22.10.1
asterisk >= 23.0.0-pre1, < 23.4.1 < 23.0.0-pre1, 23.4.1